Bugzilla – Attachment 189617 Details for
Bug 38363
get_template_and_user and checkauth don't use C4::Output for rendering auth pages
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38363: Use output_html_with_http_headers in C4::Auth
290952f.patch (text/plain), 3.91 KB, created by
Jonathan Druart
on 2025-11-14 14:39:14 UTC
(
hide
)
Description:
Bug 38363: Use output_html_with_http_headers in C4::Auth
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2025-11-14 14:39:14 UTC
Size:
3.91 KB
patch
obsolete
>From 290952fd859ddf075d767d13a23d3d4c1a907c9d Mon Sep 17 00:00:00 2001 >From: Lari Taskula <lari.taskula@hypernova.fi> >Date: Sun, 26 Oct 2025 12:32:43 +0200 >Subject: [PATCH] Bug 38363: Use output_html_with_http_headers in C4::Auth > >The following C4::Auth subroutines > - checkauth() > - get_template_and_user() > >were in some cases outputting html outside of C4::Output's output mechanisms. > >It is important to ensure the consistency of our HTTP responses. Having >multiple output mechanisms for what is essentialy the same type of response not >only leads to unneccessary code duplication and complexity but possibly even >bugs at some point in the future. > >For these reasons it is better to output only through C4::Output, when possible. > >This patch does that for the two aforementioned C4::Auth cases. > >To test unit tests: >1. prove t/db_dependent/Auth.t > >As for checkauth(), the change only applies to unauthenticated state and failed >logins. > >To test checkauth: >1. Enable system preference opacuserlogin >2. Navigate to OPAC >3. Observe OPAC loading successfully >4. Log in to OPAC with invalid credentials >5. Observe "You entered an incorrect username or password" >6. Navigate to staff client without being logged in (logout if you are in) >7. Observe staff client login screen loading successfully >8. Log in to staff client with invalid credentials >9. Observe "Invalid username or password" > >As for get_template_and_user(), the change only applies to SCO/SCI user >navigating outside of the self service modules. > >To test get_template_and_user: >1. Enable system preference WebBasedSelfCheck >2. Create a new test patron and note down their username & password >3. Grant them a permission self_checkout_module (under Self check modules) >4. Navigate to http://OPAC/cgi-bin/koha/sco/sco-main.pl >5. Log in with the test patron >6. Observe successful login (should display "Self-checkout system" page) >7. Navigate to http://OPAC/cgi-bin/koha/opac-main.pl >(you can get there by editing the address bar of your web browser) >8. Observe "Log in to your account" page, ie. you have been kicked out >9. Modify your test patron's permissions >10. Remove permission "self_checkout_module" and add "self_checkin_module" >11. Enable system preference SelfCheckInModule >12. Navigate to http://OPAC/cgi-bin/koha/sci/sci-main.pl >13. Log in using your test patron's credentials >14. Observe "Self check-in" page >15. Navigate to http://OPAC/cgi-bin/koha/opac-main.pl >(you can get there by editing the address bar of your web browser) >16. Observe "Log in to your account" page, ie. you have been kicked out > >Signed-off-by: David Cook <dcook@prosentient.com.au> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > C4/Auth.pm | 20 ++------------------ > 1 file changed, 2 insertions(+), 18 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 9776e8bc442..f58ef7c7a59 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -333,15 +333,7 @@ sub get_template_and_user { > auth_error => $auth_error, > ); > >- print $in->{query}->header( >- { >- type => 'text/html', >- charset => 'utf-8', >- cookie => $cookie, >- 'X-Frame-Options' => 'SAMEORIGIN' >- } >- ), >- $template->output; >+ C4::Output::output_html_with_http_headers( $in->{query}, $cookie, $template->output ); > safe_exit; > } > } >@@ -1610,15 +1602,7 @@ sub checkauth { > return ( undef, undef, undef, undef, $template ); > } > >- print $query->header( >- { >- type => 'text/html', >- charset => 'utf-8', >- cookie => $cookie, >- 'X-Frame-Options' => 'SAMEORIGIN', >- } >- ), >- $template->output; >+ C4::Output::output_html_with_http_headers( $query, $cookie, $template->output ); > safe_exit; > } > >-- >2.34.1 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38363
:
188465
|
188475
|
188722
| 189617